diff options
author | android-build-team Robot <android-build-team-robot@google.com> | 2018-08-10 20:32:30 +0000 |
---|---|---|
committer | android-build-team Robot <android-build-team-robot@google.com> | 2018-08-10 20:32:30 +0000 |
commit | 1fe65f4565befa76cafb70bf553b75f2f53e4f9f (patch) | |
tree | ac57537f41f60a311213cbe40e46bfa9e6692a84 | |
parent | bd639dc3e4a5cea0ae27bb61725241273c79a478 (diff) | |
parent | 1e377e3646f938beb0f440c2ae0563e1c9b5f517 (diff) | |
download | sonivox-android-8.1.0_r46.tar.gz |
Merge cherrypicks of [4741663, 4741664, 4741665, 4741666, 4743080, 4743081, 4743082, 4743083, 4741262, 4741263, 4741264, 4741265, 4741266, 4741667, 4743084, 4741242, 4741243, 4741741, 4741742, 4741743, 4741744, 4741822, 4743085, 4741668, 4741338, 4743055, 4743056, 4743070, 4743073, 4743075, 4743076, 4743078, 4743079, 4743161, 4743162, 4743164, 4743165, 4743167, 4743168, 4743169, 4743170, 4741681, 4741682, 4741683, 4741684, 4741685, 4741686, 4741687, 4741688, 4741689, 4741690, 4741691, 4741692, 4741693, 4741694, 4741695, 4741696, 4741697, 4741698, 4741699, 4743240, 4743241, 4743242, 4743243, 4741745, 4741823, 4741824, 4741825, 4741267, 4741268, 4743244, 4743280, 4743281, 4743224, 4743203, 4743204, 4743205, 4741746, 4741747, 4743245, 4741826, 4741827, 4741828, 4741829, 4741748, 4741749, 4741750, 4743233, 4743282, 4741244, 4741245, 4741246, 4741247, 4743206, 4743207, 4743208, 4743209, 4743210, 4743211, 4743212, 4743213, 4743214, 4743215, 4743216, 4743217, 4743218, 4743219, 4743360, 4743361, 4743362, 4743363, 4743364, 4743365, 4743366, 4743367, 4743368, 4743369, 4743370, 4743371, 4743372, 4743373, 4743374, 4743375, 4743376, 4743377, 4743283, 4743284, 4741830, 4742501, 4743246, 4743086, 4743087, 4743378, 4743379, 4741751] into sparse-4749909-L04200000199131547android-8.1.0_r47android-8.1.0_r46oreo-m6-s4-release
Change-Id: I60bb0b45ee7b3449b2ac9ced3951a6ac5d95413a
-rw-r--r-- | arm-wt-22k/lib_src/eas_ota.c | 5 | ||||
-rw-r--r-- | arm-wt-22k/lib_src/eas_public.c | 26 | ||||
-rw-r--r-- | arm-wt-22k/lib_src/eas_smf.c | 22 |
3 files changed, 50 insertions, 3 deletions
diff --git a/arm-wt-22k/lib_src/eas_ota.c b/arm-wt-22k/lib_src/eas_ota.c index 5bc9062..413d1d3 100644 --- a/arm-wt-22k/lib_src/eas_ota.c +++ b/arm-wt-22k/lib_src/eas_ota.c @@ -27,6 +27,9 @@ *---------------------------------------------------------------------------- */ +#define LOG_TAG "Sonivox" +#include <log/log.h> + #include "eas_data.h" #include "eas_miditypes.h" #include "eas_parser.h" @@ -211,6 +214,7 @@ static EAS_RESULT OTA_CheckFileType (S_EAS_DATA *pEASData, EAS_FILE_HANDLE fileH pData->fileOffset = offset; pData->state = EAS_STATE_OPEN; *ppHandle = pData; + ALOGD("%s() OTA file recognized", __func__); break; } @@ -360,6 +364,7 @@ static EAS_RESULT OTA_Event (S_EAS_DATA *pEASData, EAS_VOID_PTR pInstData, EAS_I /* check for loop - don't do infinite loops when locating */ if (pData->loopCount && ((parserMode == eParserModePlay) || (pData->loopCount != OTA_INFINITE_LOOP))) { + ALOGV("%s() loop backwards, loopCount = %d", __func__, pData->loopCount); /* if not infinite loop, decrement loop count */ if (pData->loopCount != OTA_INFINITE_LOOP) pData->loopCount--; diff --git a/arm-wt-22k/lib_src/eas_public.c b/arm-wt-22k/lib_src/eas_public.c index 240a422..eb41113 100644 --- a/arm-wt-22k/lib_src/eas_public.c +++ b/arm-wt-22k/lib_src/eas_public.c @@ -27,6 +27,9 @@ *---------------------------------------------------------------------------- */ +#define LOG_TAG "Sonivox" +#include "log/log.h" + #include "eas_synthcfg.h" #include "eas.h" #include "eas_config.h" @@ -1244,6 +1247,13 @@ static EAS_RESULT EAS_ParseEvents (S_EAS_DATA *pEASData, EAS_HANDLE pStream, EAS EAS_BOOL done; EAS_INT yieldCount = YIELD_EVENT_COUNT; EAS_U32 time = 0; + // This constant is the maximum number of events that can be processed in a single time slice. + // A typical ringtone will contain a few events per time slice. + // Extremely dense ringtones might go up to 50 events. + // If we see this many events then the file is probably stuck in an infinite loop + // and should be aborted. In our testing, it took less than 100 msec to hit this limit. + static const EAS_INT MAX_EVENT_COUNT = 50000; + EAS_INT eventCount = 0; /* does this parser have a time function? */ pParserModule = pStream->pParserModule; @@ -1291,9 +1301,21 @@ static EAS_RESULT EAS_ParseEvents (S_EAS_DATA *pEASData, EAS_HANDLE pStream, EAS { /* parse the next event */ - if (pParserModule->pfEvent) - if ((result = (*pParserModule->pfEvent)(pEASData, pStream->handle, parseMode)) != EAS_SUCCESS) + if (pParserModule->pfEvent) { + if ((result = (*pParserModule->pfEvent)(pEASData, pStream->handle, parseMode)) + != EAS_SUCCESS) { + ALOGE("%s() pfEvent returned %ld", __func__, result); return result; + } + } + // An infinite loop within a single frame of a ringtone file can cause this function + // to loop forever. Try to detect that and return an error. + if (++eventCount >= MAX_EVENT_COUNT) { + ALOGE("%s() aborting, %d events without advancing to next frame", + __func__, eventCount); + android_errorWriteLog(0x534e4554, "68664359"); + return EAS_ERROR_FILE_POS; + } } /* no more events in this frame, advance time */ diff --git a/arm-wt-22k/lib_src/eas_smf.c b/arm-wt-22k/lib_src/eas_smf.c index 8b54b8e..72e89c3 100644 --- a/arm-wt-22k/lib_src/eas_smf.c +++ b/arm-wt-22k/lib_src/eas_smf.c @@ -29,6 +29,9 @@ *---------------------------------------------------------------------------- */ +#define LOG_TAG "Sonivox" +#include "log/log.h" + #include "eas_data.h" #include "eas_miditypes.h" #include "eas_parser.h" @@ -126,7 +129,8 @@ EAS_RESULT SMF_CheckFileType (S_EAS_DATA *pEASData, EAS_FILE_HANDLE fileHandle, if ((result = EAS_HWReadFile(pEASData->hwInstData, fileHandle, header, sizeof(header), &count)) != EAS_SUCCESS) return result; - /* check for 'MTrk' - return if no match */ + /* check for 'MThd' - If no match then return SUCCESS with NULL handle + * to indicate not an SMF file. */ if ((header[0] != 'M') || (header[1] != 'T') || (header[2] != 'h') || (header[3] != 'd')) return EAS_SUCCESS; } @@ -833,6 +837,22 @@ static EAS_RESULT SMF_ParseMetaEvent (S_EAS_DATA *pEASData, S_SMF_DATA *pSMFData /* get the current file position so we can skip the event */ if ((result = EAS_HWFilePos(pEASData->hwInstData, pSMFStream->fileHandle, &pos)) != EAS_SUCCESS) return result; + + /* prevent a large unsigned length from being treated as a negative length */ + if ((EAS_I32) len < 0) { + /* note that EAS_I32 is a long, which can be 64-bits on some computers */ + ALOGE("%s() negative len = %ld", __func__, (long) len); + android_errorWriteLog(0x534e4554, "68953854"); + return EAS_ERROR_FILE_FORMAT; + } + /* prevent numeric overflow caused by a very large len, assume pos > 0 */ + const EAS_I32 EAS_I32_MAX = 0x7FFFFFFF; + if ((EAS_I32) len > (EAS_I32_MAX - pos)) { + ALOGE("%s() too large len = %ld", __func__, (long) len); + android_errorWriteLog(0x534e4554, "68953854"); + return EAS_ERROR_FILE_FORMAT; + } + pos += (EAS_I32) len; /* end of track? */ |